CVE-2024-27303: Vulnerability in electron-builder's NSIS installer
Summary
CVE-2024-27303: electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only). Affects app-builder-lib versions < 24.13.2. Fixed in 24.13.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The electron-builder package is an open-source tool used for building and packaging Electron applications. It provides a set of APIs and utilities to create installers for different platforms. One of the supported installers is the NSIS installer, which is primarily used for Windows applications. The NSIS installer script in electron-builder makes a system call to open cmd.exe via NSExec. However, this functionality can be exploited by an attacker to execute arbitrary code on the target machine.
Vulnerability Detail
The vulnerability lies in the way NSExec in the NSIS installer script searches for the cmd.exe executable. By default, NSExec searches the current directory of the installer before searching the system's PATH. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will unknowingly execute the malicious file. This vulnerability is specific to Windows systems. If successfully exploited, an attacker can run arbitrary code with the privileges of the installer, potentially leading to further compromise of the target machine.
How To Fix
Latest published version: 26.15.3 as of 22 Oct 2026
npm install app-builder-lib@26.15.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
24.13.2
This is the first release that contains the fix.
npm install app-builder-lib@24.13.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Unfortunately, there is no known workaround for this vulnerability. Since the NSIS installer executes at the installer-level before the application is present on the system, there is no way to check if the malicious file exists in the current installer.
Conclusion
The vulnerability in electron-builder's NSIS installer allows an attacker to execute arbitrary code on a Windows machine during the installation process. It has been fixed in version 24.13.2 of the app-builder-lib package. Developers should update their dependencies to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for app-builder-lib →
FAQ
Electron-builder is an open-source tool used for building and packaging Electron applications. It provides a set of APIs and utilities to create installers for different platforms.
The NSIS installer is one of the supported installers in electron-builder. It is primarily used for creating installers for Windows applications.
The vulnerability occurs because the NSIS installer script in electron-builder searches for the cmd.exe executable in the current directory of the installer before searching the system's PATH. This allows an attacker to place a malicious cmd.exe file in the same folder as the installer and have it executed during the installation process.
If successfully exploited, an attacker can execute arbitrary code on the target machine with the privileges of the installer. This can lead to further compromise of the system and unauthorized access to sensitive information.
Yes, the vulnerability has been fixed in version 24.13.2 of the app-builder-lib package. Developers should update their app-builder-lib dependency to at least this version to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for app-builder-lib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
